@substrat-run/control-plane-api 0.121.0 → 0.122.1

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAyEL,CAAC,EAQF,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAGf,eAAe,EAQhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAmB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAI7F,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAsBrF,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAuQ7D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AA8G7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAuEjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAswLhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EA0EL,CAAC,EAQF,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAGV,UAAU,EACV,kBAAkB,EAElB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAGf,eAAe,EAQhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAmB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAa7F,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAsBrF,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAgS7D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AA8G7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAuEjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAq9LhG"}

package/dist/api.js

@@ -1,8 +1,8 @@
 import { resolveObservabilityWindow } from './observability-window.js';
 import { Hono } from 'hono';
-import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ASSET_PART_PREFIX, assetHash, channelName, connectionActivity, connectionActivitySource, connectionCredential, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, promotionAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, } from '@substrat-run/contracts';
+import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ASSET_PART_PREFIX, assetHash, channelName, connectionActivity, connectionActivitySource, connectionCredential, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, promotionAcknowledgement, bindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, } from '@substrat-run/contracts';
 import { attributeFailure } from './failure-attribution.js';
-import { crossVerticalHealth, isExportBreakRefusal, migrationProgress, ulid } from '@substrat-run/kernel';
+import { BIND_EXPORT_BREAK_REFUSAL, bindExportBreakRefusal, crossVerticalHealth, exportBreakRefusal, isBindExportBreakRefusal, isExportBreakRefusal, migrationProgress, ulid, } from '@substrat-run/kernel';
 import { TENANT_HEADER, confinedTenant } from './auth.js';
 import { mintTenantToken } from './tenant-token.js';
 import { connectionGrantsForScope } from './vertical-client.js';
@@ -57,6 +57,22 @@ function outsideTenant(p, tenantId) {
     const pin = confinedTenant(p);
     return pin !== null && pin !== tenantId;
 }
+/**
+ * #1756: a move refused because it would break apps in the scope's own tenant. Carries the
+ * listing, because every route that moves a scope pins that tenant in its path, so the caller may
+ * read it whole; the counted sentence is the host's (`bindExportBreakRefusal`).
+ */
+class ExportBreakRefused extends ControlPlaneError {
+    breaks;
+    constructor(breaks) {
+        super(409, bindExportBreakRefusal(breaks));
+        this.breaks = breaks;
+    }
+}
+/** The body a route answers an `ExportBreakRefused` with: the sentence and the listing. */
+function exportBreakBody(e) {
+    return { error: e.message, ...(e instanceof ExportBreakRefused ? { exportBreaks: { affected: e.breaks } } : {}) };
+}
 /**
  * A fleet-wide report, narrowed to what a caller may see: a confined caller gets its own
  * tenant's rows and a COUNT of the other tenants, never their ids (K-3's forced filter, held on
@@ -179,6 +195,9 @@ const bindScopeVersionBody = z.object({
     // data first when this bind crosses a migration-digest boundary. Optional and
     // ignored on a code-only rebind — the digest compare is the gate, not the flag.
     snapshot: z.boolean().optional(),
+    // #1756: a bind that drops or re-versions an export an app in this tenant imports is
+    // refused unless acknowledged — the promote gate's `exportBreak`, for one install.
+    acknowledge: bindAcknowledgement.optional(),
 });
 const rebindScopeVerticalBody = z.object({
     // The FULL registry id of the target lineage (e.g. `substrat-9yjbbn/manyfold`) —
@@ -195,7 +214,12 @@ const rebindScopeVerticalBody = z.object({
     // backout copy exactly as in a carried rebind. The scope must be re-provisioned
     // on the target afterwards (`/verticals/:slug/instances` is idempotent, K-31).
     abandonData: z.boolean().optional(),
+    // #1756: within one lineage the rebind is an adopt, refused when it breaks an app in the tenant.
+    acknowledge: bindAcknowledgement.optional(),
 });
+// #1756: an adopt moves the scope onto what its vertical serves, and is refused when that breaks
+// an app in the tenant. The body is optional, as it always was.
+const adoptServingBody = z.object({ acknowledge: bindAcknowledgement.optional() });
 // A snapshot request (preview-and-snapshots.md §3/§9). `expiresAt` opts into the GC
 // sweep; absent = pinned until deliberately deleted. `kind` defaults to 'archive'.
 const snapshotScopeBody = z.object({
@@ -815,6 +839,8 @@ export function createControlPlaneApi(options) {
         if (err instanceof z.ZodError) {
             return problem(c, { status: 400, body: toProblem(err, c.req.path) });
         }
+        if (err instanceof ExportBreakRefused)
+            return c.json(exportBreakBody(err), 409);
         const { status, body } = mapError(err);
         // A 5xx is the PLATFORM failing — an unmapped throw, or a downstream vertical's
         // own 5xx passing through (a DO storage fault during a preview restore is the
@@ -1597,6 +1623,25 @@ export function createControlPlaneApi(options) {
         return (`no deployment is bound for vertical '${slug}': the scope is not on the serving script and its bound ` +
             `version did not resolve. Promote a version to prod, then adopt the scope onto the serving script.`);
     };
+    /**
+     * #1756: refuse, BEFORE any data moves, a move of this scope that would break apps in its
+     * tenant, unless acknowledged. The host refuses the same move whoever calls; this is what keeps
+     * a route that exports, restores or snapshots first from doing so for a move that is refused.
+     * `servingRef` is the route the scope takes in the same act (an adopt).
+     */
+    const refuseOnBreaks = async (actor, tenantId, scopeId, versionId, opts) => {
+        if (opts.acknowledge?.exportBreak)
+            return;
+        const breaks = await admin.bindingImpact(actor, tenantId, scopeId, versionId, opts.servingRef !== undefined ? { servingRef: opts.servingRef } : undefined);
+        if (breaks.length > 0)
+            throw new ExportBreakRefused(breaks);
+    };
+    /** The host's own export-break refusal (the move changed since it was asked), as the same 409. */
+    const relayHostRefusal = (err) => {
+        if (isBindExportBreakRefusal(err))
+            throw new ControlPlaneError(409, err.message);
+        throw err;
+    };
     /**
      * Move ONE legacy scope's data off its per-version dispatch script onto its vertical's
      * stable serving script (#286/#321), then flip routing. The one primitive behind both
@@ -1610,7 +1655,7 @@ export function createControlPlaneApi(options) {
      * installs short-circuit.
      * Throws `ControlPlaneError` so callers surface an actionable status, never a bare 500.
      */
-    const adoptScopeOntoServing = async (c, tenantId, scopeId) => {
+    const adoptScopeOntoServing = async (c, tenantId, scopeId, opts = {}) => {
         const actor = c.get('actor');
         const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope) {
@@ -1633,6 +1678,12 @@ export function createControlPlaneApi(options) {
         if (!serving) {
             throw new ControlPlaneError(409, `vertical '${scope.vertical}' has no serving script yet — promote a version to prod first`);
         }
+        // #1756: onto the serving script, the scope runs the served version from the moment routing
+        // flips — whatever its own version exported. Asked before the export below moves anything.
+        await refuseOnBreaks(actor, tenantId, scopeId, serving.versionId, {
+            servingRef: serving.ref,
+            acknowledge: opts.acknowledge,
+        });
         const source = await verticalForScope(c, scope);
         const dest = await options.resolveVerticalRef?.(serving.ref);
         if (!source || !dest) {
@@ -1641,8 +1692,12 @@ export function createControlPlaneApi(options) {
         const dump = await source.exportScope(scopeId);
         const restored = await retryTransient(() => dest.restoreScope(tenantId, scopeId, dump));
         // Data landed — only now flip routing and move the version pointer.
-        await admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref);
-        await admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId);
+        await admin
+            .setScopeServingRef(actor, tenantId, scopeId, serving.ref, { acknowledge: opts.acknowledge })
+            .catch(relayHostRefusal);
+        await admin
+            .bindScopeVersion(actor, tenantId, scopeId, serving.versionId, { acknowledge: opts.acknowledge })
+            .catch(relayHostRefusal);
         // #1674: the scope now routes to a different store, so put the directory's recorded
         // OFF positions back there — cheap and idempotent when the dump carried them.
         await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
@@ -1661,29 +1716,51 @@ export function createControlPlaneApi(options) {
      * Idempotent and retry-safe: the host cascade never rebound these scopes, so their data
      * is still findable on a retry after a failed serve.
      */
-    const adoptAndRebindOwnedScopes = async (c, slug, versionId) => {
+    const adoptAndRebindOwnedScopes = async (c, slug, versionId, 
+    // #1756: the promote's own acknowledgement. An install adopted here goes from ITS version to
+    // the promoted one, which the promote gate judged only from the channel's previous version:
+    // an install lagging behind that is judged again, and passes on the promote's ack or not at all.
+    acknowledge) => {
         const actor = c.get('actor');
+        const none = { refused: [] };
         const serving = await admin.verticalServing(actor, slug);
         if (!serving)
-            return; // embedded / not dispatch-backed — the host cascade handled rebinds
+            return none; // embedded / not dispatch-backed — the host cascade handled rebinds
         const v = await verticalOf(actor, slug);
         if (!v || v.ownerTenant === null || v.listed)
-            return; // private only, like the host cascade
+            return none; // private only, like the host cascade
         const owned = (await admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview');
+        // An install refused for what it would break is left where it is, and the rest still move:
+        // one lagging app must not keep every other install's pointer, or the store backfill after
+        // this, from happening. The caller answers with what was refused.
+        const refused = [];
+        let refusal;
         for (const s of owned) {
-            if (!s.servingRef) {
-                // Adopt: export from the scope's current (un-rebound) dispatch → serving script,
-                // then bind to the serving version. Data-first, so a failure here leaves the
-                // scope intact on its old script for the next promote to retry.
-                await adoptScopeOntoServing(c, s.tenantId, s.id);
+            try {
+                if (!s.servingRef) {
+                    // Adopt: export from the scope's current (un-rebound) dispatch → serving script,
+                    // then bind to the serving version. Data-first, so a failure here leaves the
+                    // scope intact on its old script for the next promote to retry.
+                    await adoptScopeOntoServing(c, s.tenantId, s.id, { acknowledge });
+                }
+                else if (s.verticalVersionId !== versionId) {
+                    // Already on the serving script (born there, or adopted earlier): routing is
+                    // pinned to servingRef, so advancing the version pointer only affects Update
+                    // offers. Snapshot on a migration-digest crossing (fork-before-promote, §4).
+                    await admin.bindScopeVersion(actor, s.tenantId, s.id, versionId, { snapshot: true, acknowledge });
+                }
             }
-            else if (s.verticalVersionId !== versionId) {
-                // Already on the serving script (born there, or adopted earlier): routing is
-                // pinned to servingRef, so advancing the version pointer only affects Update
-                // offers. Snapshot on a migration-digest crossing (fork-before-promote, §4).
-                await admin.bindScopeVersion(actor, s.tenantId, s.id, versionId, { snapshot: true });
+            catch (e) {
+                if (e instanceof ExportBreakRefused)
+                    refused.push(...e.breaks);
+                else if (isBindExportBreakRefusal(e) || (e instanceof ControlPlaneError && e.message.startsWith(BIND_EXPORT_BREAK_REFUSAL))) {
+                    refusal ??= e.message; // the host's own refusal (the answer moved under us): counts only
+                }
+                else
+                    throw e;
             }
         }
+        return { refused, ...(refusal ? { refusal } : {}) };
     };
     /**
      * Move ONE scope onto a DIFFERENT vertical lineage's serving script (#389) — the
@@ -1721,13 +1798,20 @@ export function createControlPlaneApi(options) {
             await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
             return { servingRef: serving.ref, versionId: serving.versionId, alreadyBound: true };
         }
+        // #1756: within one lineage this is an adopt, and judged as one before anything moves. A
+        // crossing is not judged (`bindExportBreaksOf`): the producer's slug itself changes.
+        await refuseOnBreaks(actor, tenantId, scopeId, serving.versionId, {
+            servingRef: serving.ref,
+            acknowledge: opts.acknowledge,
+        });
+        const move = { acknowledge: opts.acknowledge };
         if (opts.abandonData) {
             // Directory-only crossing: no bytes move, so the frontier gate has nothing to
             // protect — the target provisions its own schema from scratch. The source
             // script's copy is untouched and remains the backout, same as a carried rebind.
             // The scope serves nothing until `/verticals/:slug/instances` re-provisions it.
-            await admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref);
-            await admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId);
+            await admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref, move).catch(relayHostRefusal);
+            await admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId, move).catch(relayHostRefusal);
             return { servingRef: serving.ref, versionId: serving.versionId, dataAbandoned: true };
         }
         // The frontier gate. Digest equality proves the target's migration set is exactly
@@ -1755,8 +1839,8 @@ export function createControlPlaneApi(options) {
         // `bindScopeVersion` rewrites `scopes.vertical` from the version row, audited. No
         // extra snapshot here (adopt-serving's precedent): the source script's copy is the
         // pre-migration state, and it is never deleted — that copy is the backout.
-        await admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref);
-        await admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId);
+        await admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref, move).catch(relayHostRefusal);
+        await admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId, move).catch(relayHostRefusal);
         // #1674: re-assert the recorded OFF positions in the store the scope now routes to.
         await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
         return { servingRef: serving.ref, versionId: serving.versionId, tables: restored.tables };
@@ -3231,13 +3315,14 @@ export function createControlPlaneApi(options) {
     app.post('/tenants/:tenantId/scopes/:scopeId/adopt-serving', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
+        const { acknowledge } = adoptServingBody.parse(await c.req.json().catch(() => ({})));
         try {
-            const r = await adoptScopeOntoServing(c, tenantId, scopeId);
+            const r = await adoptScopeOntoServing(c, tenantId, scopeId, { acknowledge });
             return c.json({ adopted: scopeId, ...r });
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message }, e.status);
+                return c.json(exportBreakBody(e), e.status);
             }
             throw e;
         }
@@ -3264,17 +3349,18 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'adopt-serving is a private-vertical operation' }, 409);
         }
         const owned = (await admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug })).filter((s) => !s.forkedFrom && s.kind !== 'preview' && s.status === 'active');
+        const { acknowledge } = adoptServingBody.parse(await c.req.json().catch(() => ({})));
         const adopted = [];
         const alreadyAdopted = [];
         try {
             for (const s of owned) {
-                const r = await adoptScopeOntoServing(c, s.tenantId, s.id);
+                const r = await adoptScopeOntoServing(c, s.tenantId, s.id, { acknowledge });
                 (r.alreadyAdopted ? alreadyAdopted : adopted).push(s.id);
             }
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message, adopted, alreadyAdopted }, e.status);
+                return c.json({ ...exportBreakBody(e), adopted, alreadyAdopted }, e.status);
             }
             throw e;
         }
@@ -3288,21 +3374,34 @@ export function createControlPlaneApi(options) {
     app.post('/tenants/:tenantId/scopes/:scopeId/rebind-vertical', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
-        const { vertical, ackMigrations, abandonData } = rebindScopeVerticalBody.parse(await c.req.json());
+        const { vertical, ackMigrations, abandonData, acknowledge } = rebindScopeVerticalBody.parse(await c.req.json());
         try {
             const r = await rebindScopeOntoVertical(c, tenantId, scopeId, vertical, {
                 ackMigrations,
                 abandonData,
+                acknowledge,
             });
             return c.json({ rebound: scopeId, vertical, ...r });
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message }, e.status);
+                return c.json(exportBreakBody(e), e.status);
             }
             throw e;
         }
     });
+    // #1756: which apps in this tenant binding `versionId` onto the scope would break — the
+    // question the bind below refuses on, as a read, so a client can ask it before it records
+    // anything of its own (the dashboard's Activity line) and show what an acknowledgement would
+    // break. Refuses what the bind would refuse first (unknown scope or version, not admitted).
+    // Callers: staff, and a tenant's own credential pinned to the tenant in the path; a builder's
+    // push token is not in BUILDER_ROUTES. Every row is in that tenant.
+    app.get('/tenants/:tenantId/scopes/:scopeId/binding-impact', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
+        const versionId = z.string().min(1).parse(c.req.query('versionId'));
+        return c.json({ affected: await admin.bindingImpact(c.get('actor'), tenantId, scopeId, versionId) });
+    });
     // Pin a scope to a vertical version (#31; orchestration.md §4). Refuses a
     // non-admitted version below the seam — that refusal is the registry's reason to
     // exist. A scope operation, so it keeps the scope route shape. `snapshot: true`
@@ -3318,9 +3417,16 @@ export function createControlPlaneApi(options) {
     app.post('/tenants/:tenantId/scopes/:scopeId/version', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
-        const { versionId, snapshot } = bindScopeVersionBody.parse(await c.req.json());
+        const { versionId, snapshot, acknowledge } = bindScopeVersionBody.parse(await c.req.json());
         const actor = c.get('actor');
         const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        // #1756: the apps in this tenant the bind would break, asked BEFORE the carry and the
+        // snapshot below, which move data. The host refuses too, whoever calls, but by then a
+        // refusal would land after the bytes had moved. It refuses what the bind would refuse
+        // first (a version not admitted) the same way. An unknown scope has no impact to read, and
+        // the bind below refuses it as it always has.
+        if (scope)
+            await refuseOnBreaks(actor, tenantId, scopeId, versionId, { acknowledge });
         // A refusal throws a ControlPlaneError, which the app's error boundary relays with its
         // status and records as an ops failure. An unknown scope carries nothing, and the bind
         // below refuses it as it always has.
@@ -3334,6 +3440,9 @@ export function createControlPlaneApi(options) {
             if (scope)
                 await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
         };
+        // The host's own refusal, should the impact have changed since it was read above (a
+        // promote landing in between): relayed as the same 409, never as a 500.
+        const bind = (opts) => admin.bindScopeVersion(actor, tenantId, scopeId, versionId, opts).catch(relayHostRefusal);
         if (snapshot) {
             if (!scope) {
                 return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
@@ -3351,19 +3460,23 @@ export function createControlPlaneApi(options) {
                     migrationCrossing = Boolean(current && incoming && current.migrationDigest !== incoming.migrationDigest);
                 }
                 await carry();
-                if (migrationCrossing)
+                if (migrationCrossing) {
+                    // Asked again after the carry: a promote landing since the first question would
+                    // otherwise leave an archive behind for a bind the host then refuses.
+                    await refuseOnBreaks(actor, tenantId, scopeId, versionId, { acknowledge });
                     await orchestratedSnapshot(c, tenantId, scope, {});
-                await admin.bindScopeVersion(actor, tenantId, scopeId, versionId);
+                }
+                await bind({ acknowledge });
             }
             else {
                 await carry();
-                await admin.bindScopeVersion(actor, tenantId, scopeId, versionId, { snapshot: true });
+                await bind({ acknowledge, snapshot: true });
             }
             await reassert();
             return c.json(await admin.getScopeRecord(actor, tenantId, scopeId));
         }
         await carry();
-        await admin.bindScopeVersion(actor, tenantId, scopeId, versionId);
+        await bind({ acknowledge });
         await reassert();
         return c.json(await admin.getScopeRecord(actor, tenantId, scopeId));
     });
@@ -3534,6 +3647,23 @@ export function createControlPlaneApi(options) {
         const pin = confinedTenant(p);
         return pin !== null && (await ownerOf(p.actor, slug)) !== pin;
     };
+    /**
+     * The READ twin of `notOwned`, for the routes an installed app's own pages ask
+     * (versions, channels, and one version's registry, schedules, flow, model, assets). A
+     * LISTED vertical is installable by every tenant, so every tenant running it reads what
+     * it runs; ownership decides who may push or promote it, not who may see it. Without
+     * this, the dashboard's tenant-narrowed seam (#977) reads a listed vertical another
+     * tenant published as absent, and its app page shows no version at all. A PRIVATE
+     * vertical stays owner-only, and so do the reads narrowed on purpose (migration SQL,
+     * the prod history).
+     */
+    const notReadable = async (p, slug) => {
+        const pin = confinedTenant(p);
+        if (pin === null)
+            return false;
+        const v = await verticalOf(p.actor, slug);
+        return !v || (v.ownerTenant !== pin && !v.listed);
+    };
     // The vertical id a request actually addresses. For a BUILDER it is `<tenantSlug>/<name>`
     // (builder-plane.md §5): they send a bare `--slug`, the control plane forms the prefix
     // from their authenticated tenant — so two builders can each own a `helpdesk` with no
@@ -3708,7 +3838,7 @@ export function createControlPlaneApi(options) {
         const slug = await resolveVerticalId(c, c.req.param('slug'));
         // A builder reading a vertical it does not own gets 404 — indistinguishable from
         // absent, the same fail-closed reflex K-3 uses for a cross-tenant scope.
-        if (await notOwned(p, slug)) {
+        if (await notReadable(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
         const page = pageParams(c);
@@ -3729,6 +3859,28 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'forbidden' }, 403);
         }
         input.verticalSlug = slug;
+        // `manifestJson` is a string the schema cannot look inside, and every reader parses it
+        // with `storedDeployManifest` and 500s on a row it refuses: the per-version reads below
+        // (registry, schedules, flow, model, assets), the serving-upload rebuild that promote
+        // and backout run (`serveVersionInPlace`), and `tenant-stores.ts`.
+        // Hold it to that same parser here, at the trust boundary. The STORED
+        // form, not the push-time one: this route keeps accepting what the platform already holds
+        // (no `registry`, pre-#286 nulls), and refuses only what no reader could open. The string
+        // is stored as sent — re-serializing would drop keys a newer publisher carries.
+        if (input.manifestJson != null) {
+            let raw;
+            try {
+                raw = JSON.parse(input.manifestJson);
+            }
+            catch {
+                return c.json({ error: 'manifestJson is not valid JSON' }, 400);
+            }
+            const checked = storedDeployManifest.safeParse(raw);
+            if (!checked.success) {
+                const issue = checked.error.issues[0];
+                return c.json({ error: `manifestJson is not a deploy manifest: ${issue.path.join('.') || '(root)'}: ${issue.message}` }, 400);
+            }
+        }
         await admin.publishVersion(c.get('actor'), input);
         const version = await admin.getVersion(c.get('actor'), input.id, slug);
         return c.json(version, 201);
@@ -3742,7 +3894,7 @@ export function createControlPlaneApi(options) {
     app.get('/verticals/:slug/versions/:id/registry', async (c) => {
         const p = c.get('principal');
         const slug = await resolveVerticalId(c, c.req.param('slug'));
-        if (await notOwned(p, slug)) {
+        if (await notReadable(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
         const json = await admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
@@ -3753,20 +3905,18 @@ export function createControlPlaneApi(options) {
     // and `substrat promote` show before a migration change is acknowledged. `?base=` names the
     // version to compare against (the one `prod` serves); without it every migration is listed.
     // Owner-narrowed like `/registry`, and never widened: migration SQL describes a schema.
-    // `migrations` is null for a version whose manifest carries none (pushed before the field,
-    // or over the push's cap), which a reader must show as "SQL not available", never as
-    // "no migrations". Bounded in count and bytes (`migrationsOnTop`).
+    // `migrations` is null for a version that carries none (pushed before the field, or over
+    // the push's cap), which a reader must show as "SQL not available", never as
+    // "no migrations". Bounded in count and bytes (`migrationsOnTop`). The SQL is stored apart
+    // from the manifest (#1764), so this reads it without parsing either manifest.
     app.get('/verticals/:slug/versions/:id/migrations', async (c) => {
         const p = c.get('principal');
         const slug = await resolveVerticalId(c, c.req.param('slug'));
         if (await notOwned(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
-        // `versionManifest` refuses a version of another vertical, so `base` cannot reach one.
-        const migrationsOf = async (id) => {
-            const json = await admin.versionManifest(c.get('actor'), slug, id);
-            return json ? (storedDeployManifest.parse(JSON.parse(json)).migrations ?? null) : null;
-        };
+        // `versionMigrations` refuses a version of another vertical, so `base` cannot reach one.
+        const migrationsOf = (id) => admin.versionMigrations(c.get('actor'), slug, id);
         const base = c.req.query('base');
         const [incoming, baseline] = await Promise.all([
             migrationsOf(c.req.param('id')),
@@ -3784,7 +3934,7 @@ export function createControlPlaneApi(options) {
     app.get('/verticals/:slug/versions/:id/schedules', async (c) => {
         const p = c.get('principal');
         const slug = await resolveVerticalId(c, c.req.param('slug'));
-        if (await notOwned(p, slug)) {
+        if (await notReadable(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
         const json = await admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
@@ -3807,7 +3957,7 @@ export function createControlPlaneApi(options) {
     app.get('/verticals/:slug/versions/:id/flow', async (c) => {
         const p = c.get('principal');
         const slug = await resolveVerticalId(c, c.req.param('slug'));
-        if (await notOwned(p, slug)) {
+        if (await notReadable(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
         const json = await admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
@@ -3835,7 +3985,7 @@ export function createControlPlaneApi(options) {
     app.get('/verticals/:slug/versions/:id/model', async (c) => {
         const p = c.get('principal');
         const slug = await resolveVerticalId(c, c.req.param('slug'));
-        if (await notOwned(p, slug)) {
+        if (await notReadable(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
         const json = await admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
@@ -3854,7 +4004,7 @@ export function createControlPlaneApi(options) {
     app.get('/verticals/:slug/versions/:id/assets', async (c) => {
         const p = c.get('principal');
         const slug = await resolveVerticalId(c, c.req.param('slug'));
-        if (await notOwned(p, slug)) {
+        if (await notReadable(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
         const json = await admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
@@ -3943,7 +4093,7 @@ export function createControlPlaneApi(options) {
     app.get('/verticals/:slug/channels', async (c) => {
         const p = c.get('principal');
         const slug = await resolveVerticalId(c, c.req.param('slug'));
-        if (await notOwned(p, slug)) {
+        if (await notReadable(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
         const page = pageParams(c);
@@ -4118,6 +4268,39 @@ export function createControlPlaneApi(options) {
             return { minted: [], error: message };
         }
     };
+    /**
+     * Which installed apps promoting `versionId` to `channel` would break: the promote gate's own
+     * answer (`promotionImpact`, judged from the channel's previous version), and — for a PRIVATE,
+     * dispatch-backed vertical's prod — what adopting each owned install still on its own version
+     * would break (#1756). That adopt runs after the serve and carries the promote's acknowledgement,
+     * so the acknowledgement must be asked against both, or it would cover breaks nobody was shown.
+     * Over-approximates for a host that cannot serve in place, where no adopt runs: an extra line
+     * costs a read, a missing one a silent stall.
+     */
+    const promoteImpactOf = async (actor, slug, channel, versionId) => {
+        const gate = await admin.promotionImpact(actor, slug, channel, versionId);
+        if (channel !== 'prod')
+            return gate;
+        const v = await verticalOf(actor, slug);
+        if (!v || v.ownerTenant === null || v.listed)
+            return gate;
+        const incoming = await admin.getVersion(actor, versionId, slug);
+        if (!incoming?.deploymentRef || incoming.admission !== 'admitted')
+            return gate;
+        const lagging = (await admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview' && !s.servingRef && s.verticalVersionId !== versionId);
+        const seen = new Set(gate.map((b) => `${b.scopeId}|${b.type}`));
+        const out = [...gate];
+        for (const s of lagging) {
+            // After the adopt it runs the promoted version, served in place: that pointer move, from
+            // what it runs now, is the move to judge.
+            for (const b of await admin.bindingImpact(actor, s.tenantId, s.id, versionId)) {
+                const key = `${b.scopeId}|${b.type}`;
+                if (!seen.has(key))
+                    (seen.add(key), out.push(b));
+            }
+        }
+        return out;
+    };
     // #1705 PR 3: which installed apps promoting `?versionId=` would break (an export they import,
     // dropped or re-versioned), BEFORE promoting, so a dialog can show it and ask for the
     // acknowledgement up front, as it does for the digests. The promote's own 409 carries the same
@@ -4133,7 +4316,7 @@ export function createControlPlaneApi(options) {
             if (!v || v.ownerTenant !== pin)
                 return c.json({ error: 'forbidden' }, 403);
         }
-        const breaks = await admin.promotionImpact(c.get('actor'), slug, channel, versionId);
+        const breaks = await promoteImpactOf(c.get('actor'), slug, channel, versionId);
         const { visible, otherTenants } = narrowToCaller(breaks, pin);
         return c.json({ affected: visible, ...(otherTenants ? { otherTenants } : {}) });
     });
@@ -4179,8 +4362,13 @@ export function createControlPlaneApi(options) {
         // the way the store backfill below is: a confined caller sees its own tenant's apps and the
         // rest as a count, never another tenant's id. Read only when there is something to say: on
         // the refusal, and before an acknowledged promotion moves the channel it is measured from.
+        // The whole answer is kept beside the narrowed listing, so the refusal's sentence counts the
+        // same breaks the listing lists (in counts, which name no tenant) — the host's own sentence
+        // counts only the gate's half of them.
+        let counted = [];
         const breaksOf = async () => {
-            const breaks = await admin.promotionImpact(c.get('actor'), slug, channel, versionId);
+            const breaks = await promoteImpactOf(c.get('actor'), slug, channel, versionId);
+            counted = breaks;
             if (breaks.length === 0)
                 return null;
             const { visible, otherTenants } = narrowToCaller(breaks, confinedTenant(p));
@@ -4202,13 +4390,14 @@ export function createControlPlaneApi(options) {
                 exportBreaks: null,
                 exportBreaksUnavailable: `which apps it breaks could not be read: ${e instanceof Error ? e.message : String(e)}`,
             }));
-            return c.json({ error: err.message, ...listing }, 409);
+            return c.json({ error: listing.exportBreaks ? exportBreakRefusal(counted) : err.message, ...listing }, 409);
         }
         // The in-place serve (#286), prod only, AFTER every promote gate has passed —
         // uploading first would deploy to live scopes before the acknowledgement check.
         // A failed serve is NOT a failed promote: the channel moved (audited), old code
         // still serves, and promoting again retries the upload.
         let backfill = { minted: [] };
+        let adopted = { refused: [] };
         if (channel === 'prod') {
             try {
                 await serveVersionInPlace(c.get('actor'), slug, versionId);
@@ -4217,7 +4406,9 @@ export function createControlPlaneApi(options) {
                 // dispatch-backed vertical (#321), in the correct order (serve → adopt → rebind),
                 // so a legacy scope's data survives the promote instead of being stranded on a
                 // fresh per-version script. Retry-safe: nothing rebound these scopes yet.
-                await adoptAndRebindOwnedScopes(c, slug, versionId);
+                // Only the export-break acknowledgement is the adopt's to carry: the digest ones are the
+                // promote's own, and a bind's strict acknowledgement refuses them (#1756).
+                adopted = await adoptAndRebindOwnedScopes(c, slug, versionId, acknowledge?.exportBreak ? { exportBreak: true } : undefined);
                 // #825: and mint whatever THIS version newly declares for the tenants already
                 // installed — after the serve, so the declaration being read is the one now live.
                 backfill = await backfillFleetStores(c, slug);
@@ -4231,6 +4422,31 @@ export function createControlPlaneApi(options) {
                 }, 502);
             }
         }
+        // #1756: served, and every install that could move has moved and been backfilled, but one
+        // still on its own version would break apps in its tenant if moved onto the serving script —
+        // a move the promote gate never judged, since that install was not on the channel's previous
+        // version. It is left where it is. Promoting again acknowledged moves it.
+        if (adopted.refused.length > 0 || adopted.refusal) {
+            const sentence = adopted.refused.length > 0 ? bindExportBreakRefusal(adopted.refused) : adopted.refusal;
+            return c.json({
+                error: `promoted and served, but an app still on its own version was not moved onto the serving script: ` +
+                    `${sentence}. Promote again with the export-break acknowledgement to move it`,
+                ...(adopted.refused.length > 0 ? { exportBreaks: { affected: adopted.refused } } : {}),
+                // Narrowed as the success answer's is: a builder never reads another tenant's id here.
+                ...(backfill.minted.length || backfill.error
+                    ? (() => {
+                        const { visible, otherTenants } = narrowToCaller(backfill.minted, confinedTenant(c.get('principal')));
+                        return {
+                            storeBackfill: {
+                                minted: visible,
+                                ...(otherTenants ? { otherTenants } : {}),
+                                ...(backfill.error ? { error: backfill.error } : {}),
+                            },
+                        };
+                    })()
+                    : {}),
+            }, 409);
+        }
         const promoted = (await admin.listChannels(c.get('actor'), slug)).find((ch) => ch.channel === channel);
         // The store backfill rides the response only when it has something to say (#825), so
         // nothing changes for the overwhelming majority of promotes — and when a store WAS